Cross-Site Script Inclusion

Public preview

Want everyone on your software team to learn this? Free 14-day trial.

Train my team

Bear in mind that the same applies in the opposite direction. Any JavaScript URLs hosted on your site can be imported by third-party websites, including those run by hackers.

index.html
HTML 
<!--
  Load in a JavaScript library from another origin. This will succeed
  because browsers allow JavaScript to be loaded from other origins.
-->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>